{"id":"CVE-2020-13945","aliases":["BIT-apisix-2020-13945","EUVD-2020-6132","GHSA-c538-784j-qcxc"],"status":"published","title":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction...","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.73585,"percentile":0.99471,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2020-12-07T19:04:52Z","modified":"2026-10-24T10:30:32Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/apache_apisix_api_default_token_rce","title":"APISIX Admin API default access token RCE","type":"exploit","platform":"Unix","date":"2020-12-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_apisix_api_default_token_rce"},{"source":"pocgithub","id":"YutuSec/Apisix_Crack","title":"YutuSec/Apisix_Crack","date":"2022-05-09","url":"https://github.com/YutuSec/Apisix_Crack"},{"source":"pocgithub","id":"CyberCTF/vulhub-apisix-cve-2020-13945","title":"CyberCTF/vulhub-apisix-cve-2020-13945","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-apisix-cve-2020-13945"},{"source":"nuclei","id":"CVE-2020-13945","title":"Apache APISIX - Insufficiently Protected Credentials","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13945.yaml"}],"fixes":[{"ecosystem":"Bitnami","package":"apisix","fixed_in":["1.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"apisix","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.5.1"}]}]}],"products":[{"vendor":"apache","product":"apisix"},{"vendor":"apache software foundation","product":"apache apisix"}],"references":[{"url":"https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13945","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c538-784j-qcxc"}],"sources":{"cve":[{"id":"CVE-2020-13945","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2020-12-07T19:04:52Z","modified":"2024-08-04T12:32:14.572Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-6132","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2020-12-07T19:04:52Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.697348Z"}],"ghsa":[{"id":"GHSA-c538-784j-qcxc","title":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction...","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2022-05-24T17:35:26Z","modified":"2023-01-29T05:04:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:45:36.114986Z"}],"nvd":[{"id":"CVE-2020-13945","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2020-12-07T20:15:12.557Z","modified":"2026-06-17T02:53:57.353Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-13945","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2020-12-07T20:15:12.557Z","modified":"2026-10-24T10:30:32.141062855Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"BIT-apisix-2020-13945","description":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","status":"published","published":"2024-03-06T10:51:26.305Z","modified":"2026-09-08T08:45:32.077644157Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}